New York Medical Records Retention Laws (2026 Guide)

New York has detailed rules governing how long physicians, hospitals, and other healthcare providers must retain patient medical records. These requirements come from multiple sources of law, including the New York Education Law, the Public Health Law, state regulations, and federal rules from HIPAA and CMS.

This guide covers every major retention requirement, explains how the rules differ between physician offices and hospitals, breaks down patient access rights and copy fees, and answers common questions about record destruction and practice closures.

How Long Must Physicians Keep Medical Records in New York?

Under New York Education Law 6530, subdivision 32, physicians licensed in New York must maintain a medical record for every patient that accurately reflects the evaluation and treatment provided. Failure to do so constitutes professional misconduct.

The retention period for physician records is straightforward. Unless another law requires a longer period, all patient records must be kept for at least 6 years from the date of the patient's last visit or treatment.

This 6-year minimum applies to all types of physician records, including office visit notes, test results, imaging orders, referral documentation, and treatment plans.

Records of Minors and Obstetrical Records

Physicians must retain obstetrical records and records of minor patients for at least 6 years or until one year after the minor patient reaches the age of 18, whichever period is longer. In practice, this means a physician must hold a minor's records until the patient turns 19 at minimum.

For example, if a physician treats a 5-year-old patient and never sees that patient again, the record cannot be destroyed until the patient reaches age 19. That is 14 years of retention, well beyond the standard 6-year rule.

If a physician treats a 16-year-old, the 6-year rule (ending when the patient is 22) actually exceeds the minor rule (age 19), so the record must be kept for 6 years.

Professional Misconduct Consequences

The New York State Board for Professional Medical Conduct enforces these requirements. A physician who fails to maintain adequate records or destroys records prematurely may face disciplinary action, including fines, license suspension, or revocation.

Hospital Medical Records Retention Requirements

Hospitals in New York operate under a separate and somewhat stricter set of retention rules. These come from 10 NYCRR 405.10, the state regulation governing hospital medical record services, issued under the authority of Public Health Law Article 28.

Under 10 NYCRR 405.10, hospitals must retain medical records in their original or legally reproduced form for at least 6 years from the date of discharge.

Hospital Records of Minors

The minor patient rule for hospitals is more generous than the physician rule. Hospitals must keep records of minor patients for at least 6 years after discharge or 3 years after the patient reaches the age of 18 (effectively until age 21), whichever is longer.

This means hospitals retain minor records for up to 3 years longer than private physician offices are required to, depending on the patient's age at the time of treatment.

Records After a Patient's Death

Hospitals must retain patient records for at least 6 years after the death of the patient. This applies regardless of whether the patient died at the hospital or elsewhere, as long as the hospital holds records for that individual.

Federal Requirements: HIPAA and CMS

HIPAA Does Not Set a Retention Period

A common misconception is that HIPAA requires providers to keep medical records for a specific number of years. According to the U.S. Department of Health and Human Services, the HIPAA Privacy Rule does not include medical record retention requirements. State laws govern how long medical records must be retained.

However, HIPAA does require covered entities to maintain their privacy policies, procedures, notices, and complaint records for at least 6 years from the date of creation or last effective date.

HIPAA also requires that when records are eventually destroyed, the disposal must render protected health information (PHI) essentially unreadable, indecipherable, and unable to be reconstructed.

CMS and Medicare Requirements

Providers who participate in Medicare face additional federal retention rules from the Centers for Medicare and Medicaid Services (CMS). Under 42 CFR 424.516(f), Medicare providers and suppliers must maintain documentation for 7 years from the date of service.

For hospitals specifically, the Medicare Conditions of Participation at 42 CFR 482.24 require hospitals to have a medical record service and to maintain a complete medical record for every individual evaluated or treated.

Because the CMS 7-year requirement exceeds New York's 6-year minimum, any New York provider who accepts Medicare must keep records for at least 7 years to remain in compliance with both state and federal law.

Patient Access Rights and Copy Fees

Your Right to Access Records

New York Public Health Law Section 18 grants patients and their authorized representatives the right to access their medical records. When a patient submits a written request for access, the provider must make the records available for inspection within 10 business days.

If the patient requests copies, those must also be provided within a reasonable time. The New York State Department of Health confirms that patients have the right to see and obtain copies of their medical records from both physicians and hospitals.

A provider cannot deny access to records simply because the patient owes an unpaid balance.

Copy Fee Limits

New York law caps the fees that providers can charge for medical record copies:

• Paper copies: No more than $0.75 per page, plus postage
• Electronic copies: The lesser of $0.75 per page or a total of $100
• Radiographic materials (X-rays, MRIs): Actual reproduction costs
• Original mammograms: No copy charge, though the provider may charge the actual documented cost of furnishing the films

No-Fee Situations

Providers may not charge any fee for providing copies of medical records when the records are requested to support:

• An application for any government benefit or program
• A claim related to a government benefit
• An appeal of a government benefit decision

This includes applications for Social Security disability, Medicaid, veterans' benefits, and similar programs.

Secure Destruction of Medical Records

Once the retention period expires, providers are not required to keep records indefinitely, but they must destroy them properly.

Under HIPAA disposal requirements, covered entities must ensure that PHI is rendered unreadable and cannot be reconstructed before disposal. Acceptable methods include:

• Paper records: Shredding, burning, pulping, or pulverizing
• Electronic media: Clearing (overwriting with non-sensitive data), purging (degaussing), or physical destruction (disintegration, melting, incinerating, or shredding the media)

Simply placing records in a dumpster or recycling bin without rendering them unreadable is a HIPAA violation, even if the retention period has expired.

The New York Department of State also advises all businesses handling personal information to implement secure destruction procedures.

Providers should maintain a destruction log documenting what was destroyed, when, how, and by whom. This creates a defensible record in case questions arise later.

What Happens When a Medical Practice Closes

When a physician retires or a medical practice closes in New York, the retention obligations do not disappear. The provider remains responsible for ensuring that patient records are preserved for the full required retention period.

According to the New York State Education Department, Office of the Professions, when closing a practice, providers must:

1. Notify patients and give them the option to receive a copy of their record, have their record transferred to another provider of their choice, or have the record placed in storage
2. Inform patients of the storage location if records are stored with another practitioner or a records custodian
3. Continue to retain records for the full minimum period required by law

For hospitals, the process is more formal. The New York State Department of Health requires hospitals to submit a closure plan that addresses patient record disposition. Hospitals must notify the DOH before publicly announcing any closure.

Finding Records from Closed Hospitals

If you need records from a hospital that has closed, contact the New York State Department of Health at 1-800-663-6114. The department maintains information about where records from closed hospitals have been transferred.

Summary of New York Retention Periods

Provider Type	General Records	Minor Patient Records	After Death
Physicians	6 years from last visit	6 years or until age 19 (whichever is longer)	6 years
Hospitals	6 years from discharge	6 years or until age 21 (whichever is longer)	6 years after death
Medicare Providers	7 years from date of service	State rule or 7 years (whichever is longer)	7 years